Freeze unseen music stress corpus and independently verified gated DTW experiment

tools/speech-rank/README.md

@@ -83,3 +83,13 @@ in the embedded ASR evidence and are independently checked; they do not authoriz
 fabricating or clamping DTW points. Missing/invalid DTW points exclude a window
 and prevent accepted scoring. Use a separate DTW report/output and retain the
 failed ordinary-v1 run. The frozen five sources/eight queries remain unchanged.
+
+The separately frozen `gated-dtw-v1` combination embeds exact manifest bytes
+with SHA `d3bf453f21dac03fd029344af2fe700480cf686d2ba5b5d7fcc79134dda1c563`.
+The ranker verifies component hashes and the original frozen VAD bytes, rebuilds
+all twelve speech windows from source intersections, requires explicit no-speech
+status for empty competitors, then independently reconstructs DTW points. All
+five sources remain mandatory; dropped windows, fabricated no-speech claims,
+tampered policy bytes and invalid points are rejected. This combination leaves
+the old gated base and ungated DTW policies unchanged. Structural token tests
+provide no new quality result; actual model inference remains a separate gate.

tools/speech-rank/src/alignment.rs

@@ -12,8 +12,50 @@ pub const DTW_POLICY: &str =
 pub const DTW_POLICY_SHA: &str = "0ea19b1a2ee9da75f0284de33aeca0fcdff0a77d88d232b0b25821a7115b83b5";
 pub const DTW_CONTRACT_SHA: &str =
     "61594d0e77c561d5d3b7c9e63178a8123841516b8f8fa781458b21ab717ad47f";
+pub const COMBINATION_POLICY: &str =
+    "gated-dtw-v1;frozen-silero-source-intersections;dtw-token-sentences-v1;all-five-sources";
+pub const COMBINATION_SHA: &str =
+    "d3bf453f21dac03fd029344af2fe700480cf686d2ba5b5d7fcc79134dda1c563";
+
+fn verify_combination(asr: &Value) -> Result<()> {
+    use sha2::{Digest, Sha256};
+    let bytes = asr["combination_policy_utf8"]
+        .as_str()
+        .context("Missing original combination policy")?
+        .as_bytes();
+    ensure!(
+        bytes.len() <= 16384
+            && format!("{:x}", Sha256::digest(bytes)) == COMBINATION_SHA
+            && asr["combination_policy_sha256"] == COMBINATION_SHA
+            && asr["combination_policy"] == COMBINATION_POLICY,
+        "Frozen combined policy changed"
+    );
+    let plan: Value = serde_json::from_slice(bytes)?;
+    ensure!(
+        plan["policy"] == COMBINATION_POLICY
+            && plan["dtw_policy_sha256"] == DTW_POLICY_SHA
+            && plan["dtw_contract_sha256"] == DTW_CONTRACT_SHA
+            && plan["ordinary_contract_sha256"] == CONTRACT_SHA
+            && plan["asr_worker_sha256"] == asr["worker_sha256"]
+            && plan["vad_report_sha256"] == asr["vad_report_sha256"]
+            && plan["sources"] == json!(super::ASSETS),
+        "Combined component provenance differs"
+    );
+    Ok(())
+}
 
 pub fn enabled(asr: &Value) -> Result<bool> {
+    let combined = asr["policy"] == super::gated::POLICY && asr["alignment_policy"] == DTW_POLICY;
+    if combined {
+        verify_combination(asr)?;
+    } else {
+        ensure!(
+            asr.get("combination_policy").is_none()
+                && asr.get("combination_policy_sha256").is_none()
+                && asr.get("combination_policy_utf8").is_none(),
+            "Combined policy outside declared gated DTW mode"
+        );
+    }
     if asr.get("alignment_policy").is_none() {
         ensure!(
             asr.get("alignment_contract_sha256").is_none()
@@ -32,7 +74,7 @@ pub fn enabled(asr: &Value) -> Result<bool> {
             && asr["candidate"] == "base"
             && asr["worker_sha256"]
                 == "12c681b4bcd9c7679b647b9a041e121a2f9e72cb2a9c6f189f529ec8b79c36f8"
-            && asr["policy"] == super::POLICY,
+            && (asr["policy"] == super::POLICY || combined),
         "Unknown token alignment provenance"
     );
     Ok(true)

tools/speech-rank/src/main.rs

@@ -374,6 +374,10 @@ fn main() -> Result<()> {
         report["alignment_policy"] = asr["alignment_policy"].clone();
         report["alignment_policy_sha256"] = asr["alignment_policy_sha256"].clone();
         report["alignment_contract_sha256"] = asr["alignment_contract_sha256"].clone();
+        if asr.get("combination_policy").is_some() {
+            report["combination_policy"] = asr["combination_policy"].clone();
+            report["combination_policy_sha256"] = asr["combination_policy_sha256"].clone();
+        }
     }
     report["phase"] = json!("document_encoding");
     checkpoint(&output, &report)?;
@@ -487,6 +491,68 @@ mod tests {
         .is_err());
     }
 
+    #[test]
+    fn frozen_gated_dtw_pool_requires_all_sources_windows_and_policy_bytes() {
+        let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
+        let path = root.join(".searchi/speech/gated-base-results.json");
+        if !path.exists() {
+            return;
+        }
+        let fixture: Value =
+            serde_json::from_slice(&fs::read(root.join("fixtures/media/fixture.json")).unwrap())
+                .unwrap();
+        let mut report: Value = serde_json::from_slice(&fs::read(path).unwrap()).unwrap();
+        let plan = include_str!("../../speech-vad/gated-dtw-policy.json");
+        report["combination_policy_utf8"] = json!(plan);
+        report["combination_policy"] = json!(alignment::COMBINATION_POLICY);
+        report["combination_policy_sha256"] = json!(alignment::COMBINATION_SHA);
+        report["alignment_policy"] = json!(alignment::DTW_POLICY);
+        report["alignment_policy_sha256"] = json!(alignment::DTW_POLICY_SHA);
+        report["alignment_contract_sha256"] = json!(alignment::DTW_CONTRACT_SHA);
+        // Explicitly synthetic token points test the coverage/protocol path,
+        // not actual alignment or quality. Original frozen VAD windows unchanged.
+        for row in report["rows"].as_array_mut().unwrap() {
+            for window in row["windows"].as_array_mut().unwrap() {
+                for segment in window["actual_whisper_json"]["transcription"]
+                    .as_array_mut()
+                    .unwrap()
+                {
+                    segment["tokens"] = json!([{"id":100,"text":segment["text"],"offsets":segment["offsets"],"t_dtw":number(&segment["offsets"]["from"]).unwrap()/10}]);
+                }
+                window["aligned_segments"] = json!(alignment::reconstruct_mode(
+                    &window["actual_whisper_json"],
+                    number(&window["offset_ms"]).unwrap(),
+                    number(&window["duration_ms"]).unwrap(),
+                    true
+                )
+                .unwrap());
+            }
+        }
+        assert!(eligible(&report, &fixture).unwrap().1.is_empty());
+        let mut changed = report.clone();
+        changed["combination_policy_utf8"] = json!(format!("{plan}\n"));
+        assert!(eligible(&changed, &fixture).is_err());
+        let mut changed = report.clone();
+        changed["rows"].as_array_mut().unwrap().pop();
+        assert!(eligible(&changed, &fixture).is_err());
+        let mut changed = report.clone();
+        changed["rows"][0]["windows"].as_array_mut().unwrap().pop();
+        assert!(eligible(&changed, &fixture).is_err());
+        let mut changed = report.clone();
+        let no_speech = changed["rows"]
+            .as_array_mut()
+            .unwrap()
+            .iter_mut()
+            .find(|row| row["status"] == "no_speech")
+            .unwrap();
+        no_speech["asr_not_run"] = json!(false);
+        assert!(eligible(&changed, &fixture).is_err());
+        let mut changed = report;
+        changed["rows"][0]["windows"][0]["actual_whisper_json"]["transcription"][0]["tokens"][0]
+            ["t_dtw"] = json!(-1);
+        assert!(eligible(&changed, &fixture).is_err());
+    }
+
     #[test]
     fn aligned_pool_preserves_all_competitors_and_marks_real_failures_ineligible() {
         let hash = "a".repeat(64);